Document GitHub App authentication for GitHub MCP server

[Copilot]

PR #11660 added GitHub App token minting for the GitHub MCP server but only updated implementation code. Users need documentation to discover and configure this enhanced security feature.

Changes

tokens.md

• New section: "GitHub App Tokens for GitHub MCP Server" with setup patterns:
  • Direct configuration via tools.github.app
  • Shared workflow via shared/github-mcp-app.md (recommended)
• Token precedence: GitHub App → github-token → GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN
• Dual app configuration: Document independent app credentials for MCP vs safe-outputs
• Updated tables: Token Selection Guide, Quick Reference with GitHub App as recommended for production

tools.md

• New subsection: "GitHub App Authentication" under GitHub Tools
• Configuration examples for local/remote modes
• Cross-references to detailed token documentation

security.md

• Recommendation tip: GitHub App as secure alternative to long-lived PATs in "Automatic GitHub Lockdown" section

Configuration Pattern

# Shared workflow (recommended)
imports:
  - shared/github-mcp-app.md  # Uses APP_ID + APP_PRIVATE_KEY repo variables

permissions:
  contents: read
  issues: write

tools:
  github:
    toolsets: [repos, issues, pull_requests]

# Direct configuration
tools:
  github:
    app:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}

Token auto-minted at workflow start with permissions matching permissions field, auto-revoked at end (even on failure).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Document GitHub app based authentication for the GitHub MCP server

See
#11660

• update tokens page

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.